1. Field of the Invention
The present invention relates to the field of computer networks. More particularly, the present invention relates to managing multiple network connections from a single PPP link with partial network address translation.
2. The Background
The Point-to-Point protocol (PPP) is a data link protocol that provides dial up access over analog or digital transmission lines. PPP provides many advanced features, including error detection, support of multiple protocols, negotiation of IP addresses at connection time, and authentication. There are three main features of PPP. The first is that it provides a framing method to delineate the end of one frame and the beginning of the next one, in order to handle error detection. The second is a link control protocol for bringing lines up, testing them, negotiating options, and bringing them down again when they are no longer needed. This is known as the Link Control Protocol (LCP). The third is a way to negotiate network layer options in a way independent of the network layer protocol to be used. Thus, the method chosen may have a different Network Control Protocol (NCP) for each network layer supported.
PPP is commonly used as the data link protocol between a user and an Internet Service Provider (ISP) or access point. This is usually accomplished through the following method. The personal computer of the user is instructed to call the ISP through a modem . After the ISP""s modem receives the call and establishes a physical connection, the personal computer sends a series of LCP packets in the payload field of one or more PPP frames. These packets, and their responses, comprise the negotiation of the session, and set the PPP parameters to be used during the session.
Once the negotiation is complete, a series of NCP packets are sent to configure the network layer. Typically, the personal computer wants to run a TCP/IP protocol stack, so it needs an IP address. The NCP for IP may then be used to assign an IP address to the user (dynamic assignment of IP addresses is now common for dial-up users). At this point, the personal computer has become an Internet host and may send and receive IP packets, just as a hardwired host could. When the user has finished, NCP is used to tear down the network layer connection and free the IP address. The LCP is then used to shut down the data link layer connection. Finally, the personal computer hangs up the modem, releasing the physical layer connection.
There are currently eleven types of LCP packets. These types are illustrated in Table 1 below, along with the direction in which they travel (from Initiator (I) to responder (R) or vice-versa) and their description.
In recent years, xe2x80x9cintranetsxe2x80x9d have been rising in popularity, especially with large companies. An intranet is an internal network that serves only a specific type of person (such as employees of a corporation, or students at a school). The intranet is usually not accessible to the general public. Intranets have become popular mainly because they allow for much more productive communication between users within the network,
even when the users are dispersed over a wide geographic area (such as in multi-national corporations).
FIG. 1 is a block diagram depicting the typical connection to an intranet. Personal computer 10 connects through a link 12 to an Internet service provider (ISP) or access point (AP)14. The ISP or AP 14 then connects through link 16 to the Intranet 18.
Many entities that maintain intranets, however, have also wanted to offer users access to the Internet or to other intranets as well. There were, however, a limited number of ways that this could be accomplished. The first, and most simple, way would be for the user to first terminate the existing PPP connection between the PC 10 and the ISP or access point 24. Then the user could log into a second intranet or to the Internet. The major drawbacks of this solution are obvious. It does not allow for simultaneous connection to two intranets, or to one intranet and the Internet, thus limiting the productivity of the user. Additionally, it requires termination of the PPP link between the PC and the ISP, thus using up valuable time on the user""s end, as he has to re-initiate a connection process.
The second way an entity could offer access to a second intranet or to the Internet is to have a preconfigured connection from the intranet to the second intranet or Internet, such that communications between the user and the second intranet or Internet pass through the intranet. FIG. 2 is a block diagram illustrating a connection to the Internet 62 through an intranet 58. A user at PC 50 maintains a PPP connection 52 to ISP 54, which is connected to the intranet 58. Intranet 58 is then connected through link 60 to the Internet 62. The drawback of this solution is that the traffic from the user at PC 50 to the Internet 62 passes through the intranet 58. This increases the traffic traveling through the intranet 58 and poses a security risk to the information sent via the intranet 58.
One major drawback of PPP, therefore, is that it is designed as a point to point protocol, meaning that it is designed for use between two endpoints. Therefore, it is currently not possible for a user to connect to two independent endpoints simultaneously (such as an intranet and the Internet, or to two independent intranets) using a single PPP link.
What is needed is a method by which a user may connect to two independent endpoints simultaneously using a single PPP link.
Additionally, when a system is designed in which data is to be sent to the Internet, Network address translation (NAT) is sometimes used. NAT is an Internet standard that enables a local-area network (LAN), intranet, or ISP to use one set of network addresses for internal traffic and a separate set of network addresses for external traffic. Network addresses are generally Internet Protocol (IP) addresses, but there are many other possible network addresses as well. At the ISP level, there is normally a gateway, which is a device that acts as an interface between the ISP and the intranet or Internet. When network address translation is used, the Gateway will act to convert the destination addresses of incoming and outgoing packets so that traffic is directed to the correct address.
Network address translation provides two main advantages. First, it adds security to the LAN or intranet, as it acts as a type of firewall, preventing users from outside the LAN or intranet from determining the internal network addressing scheme of the LAN or intranet. Second, it saves network addresses. With the ever growing popularity of the Internet and computer networks, a major issue is the availability of IP addresses. A standard IP address is 32 bytes in length, providing a total of 232 possible IP addresses. Those of ordinary skill in the art will readily recognize that not all of these possible IP addresses are available due to administrative expediencies, such as reserving blocks of IP addresses for future use. Network address translation saves IP addresses by allowing the ISP to use IP addresses internally that may be used by other networks on the Internet because there is no possibility of conflict.
There are several drawbacks, however, to using NAT. The first is that it is slightly more inefficient than not using NAT, since each packet must then be examined by a gateway or router and the translation performed. Of greater importance, however, is the fact that there are several kinds of IP applications which are incompatible with a system in which NAT is being used. These include any type of application which encrypts the header of the IP packet. One example of this is the IP security protocol (IPSec). IPSec encrypts the entire IP packet (header included) and only allows decryption at an endpoint with access privileges to the header. Since the header is encrypted, NAT will alter the packet so that the receiver of the packet will not accept the packet.
What is needed is a solution which overcomes these drawbacks.
Multiple simultaneous network connections from a single PPP connection may be accomplished. A primary PPP connection is established between a user and a first network. A first real network address for the user is then received, the first real network address assigned by the first network. Then, the gateway may establish a secondary network session between a gateway and a second network, receiving a second real network address assigned by the second network. Additional network connections may be added as secondary network sessions. Network address translation is then performed on packets traveling between the user and any of the secondary network sessions, but not on packets traveling between the user and the primary PPP connection. This allows for connection to multiple networks without disturbing the primary PPP session and also allows for the utilization of applications which may not be used with network address translation on the primary PPP session.